how to use permission via $routes->group

[yonggang-xiao]

Authorizing via Routes:

$routes->group('{locale}', static function($routes) {
    service('auth')->routes($routes);

    $routes->group(
        'admin',
        ['filter' => 'permission:admin.access'],
        static function ($routes) {
            $routes->get('users', 'UsersController::index');

            $routes->group(
                '',
                ['filter' => 'permission:users.create'],
                static function ($routes) {
                    $routes->get('users/new', 'UsersController::new');
                    $routes->post('users/create', 'UsersController::create');
                }
            );
        }
    );
});

auth()->user()->can('admin.access') yes
auth()->user()->can('users.create') no

but now user can access {locale}/admin/user/new and {locale}/admin/user/create
I wonder if the config is correct?

[yonggang-xiao]

I found the reason:
CI 4.5.4
Routing: Fixed a bug that filters passed to $routes->group() were not merged into filters passed to the inner routes.